Interpark customer data breach

In 2016, South Korean police made a striking attribution: the breach of major online retailer Interpark, which exposed the data of more than 10 million customers, had been carried out by North Korea's intelligence service — and was followed by a multi-million-dollar ransom demand.

What happened

According to South Korea's National Police Agency, North Korea's Reconnaissance General Bureau breached Interpark's network in May 2016 using a spearphishing email aimed at a specific employee. The malicious attachment let the attackers plant malware and move laterally across Interpark's servers, ultimately reaching the customer database.

The intruders exfiltrated personal data on more than 10 million shoppers, including names, email addresses, phone numbers, home addresses and other account details.

The ransom twist

What made the incident unusual was the financial demand. After stealing the data, the attackers emailed Interpark executives demanding roughly 3 billion won — about US$2.66 million — in bitcoin, threatening to leak the records otherwise. Interpark refused to pay and reported the extortion to authorities. Investigators concluded the operation blended state intelligence tradecraft with criminal monetisation, consistent with North Korea's pattern of using cyber operations to raise hard currency.

Impact and aftermath

• Over 10 million Interpark customers had personal data exposed.
• In December 2016, the Korea Communications Commission fined Interpark about 4.5 billion won for failing to adequately protect customer information — among the largest such penalties in Korea at the time.
• In November 2020, a Seoul court ordered Interpark to compensate more than 2,400 customers roughly 100,000 won each for the leak.

Why it matters

The Interpark breach is a defining example of state-sponsored hacking fused with extortion. It showed that a nation-state actor would target a commercial retailer not only for intelligence but for direct financial gain via ransom — foreshadowing the ransomware-and-extortion playbook later associated with North Korean groups such as Lazarus. For South Korea, it reinforced that consumer-facing companies are squarely in the firing line of geopolitical cyber conflict, and it strengthened the regulatory expectation that retailers invest seriously in anti-phishing defences and data protection.